sjVUdZddlZddlZddlZddlZddlZddlmZddlm Z ej e Z ehdZehdZejddd vZgd Zd Zejd ed ZejdejZdZdZejeejZejdZejdededeejZejdedeejejzZ dZ!ejde!dejejzZ"ejdejZ#de$de%de&fdZ'dd de$d!e%d"e&de&fd#Z(d$e$de&fd%Z)d&Z*ejd'e*d(ejZ+ejd)ejZ,d*Z-ejd+e-d,ejZ.ejd-Z/ejd.Z0ejd/ejZ1ejd0ejZ2ejd1Z3ejd2Z4ejd3Z5ejd4Z6ejd5Z7ejd6Z8ejd7ejZ9ejd8Z:ejd9Z;ed:Z<ejd;d<=ezd=za>d>e$de$fd?Z?ejd@Z@dAdAdBdCdDdEdFe$dGe%dHe%dIe%dJe$dKe$de$fdLZAdMe$de$fdNZBdOe$de$fdPZCd>e$de$fdQZDd>e$de$fdRZEdSe$de$fdTZFd>e$de$fdUZGdFeHde$fdVZId>e$de$fdWZJd>e$de$fdXZKdMe$de$fdYZLdZdZdZdZd[d>e$d\e&d]e&d^e&d_e&de$f d`ZMehdaZNehdbZOdce$dzde&fddZPdce$dzde&fdeZQ dzdZdfdge$dce$dzd\e&de$fdhZRdie$de$fdjZSdie$de&fdkZTdie$de&fdlZUeVdmeDaWd>e$de&fdnZXiZYeZe[do<ej\Z]de^fdpZ_d{dqZ`d|dse$de%fdtZad{duZbdvZcd>e$de&fdwZdGdxdyejeZfdS)}a2Regex-based secret redaction for logs and tool output. Applies pattern matching to mask API keys, tokens, and credentials before they reach log files, verbose output, or gateway logs. Short tokens (< 18 chars) are fully masked. Longer tokens preserve the first 6 and last 4 characters for debuggability. N) unquote_plus)_BLOCKED_PROJECT_ENV_BASENAMES>x-amz-signaturejwtkeyauthcodetokenapikeysecretapi_keysessionid_tokenpassword signature access_token client_secret refresh_token>rrrr r r r rr private_keyr authorizationrrHERMES_REDACT_SECRETStrue>1onyesr)8zsk-[A-Za-z0-9_-]{10,}zghp_[A-Za-z0-9]{10,}zgithub_pat_[A-Za-z0-9_]{10,}zgho_[A-Za-z0-9]{10,}zghu_[A-Za-z0-9]{10,}zghs_[A-Za-z0-9]{10,}zghr_[A-Za-z0-9]{10,}zxapp-\d+-[A-Za-z0-9-]{10,}zxox[baprs]-[A-Za-z0-9-]{10,}zAIza[A-Za-z0-9_-]{30,}zpplx-[A-Za-z0-9]{10,}zfal_[A-Za-z0-9_-]{10,}zfc-[A-Za-z0-9]{10,}zbb_live_[A-Za-z0-9_-]{10,}zgAAAA[A-Za-z0-9_=-]{20,}zAKIA[A-Z0-9]{16}zsk_live_[A-Za-z0-9]{10,}zsk_test_[A-Za-z0-9]{10,}zrk_live_[A-Za-z0-9]{10,}zSG\.[A-Za-z0-9_-]{10,}zhf_[A-Za-z0-9]{10,}zr8_[A-Za-z0-9]{10,}znpm_[A-Za-z0-9]{10,}zpypi-[A-Za-z0-9_-]{10,}zdop_v1_[A-Za-z0-9]{10,}zdoo_v1_[A-Za-z0-9]{10,}zam_[A-Za-z0-9_-]{10,}zsk_[A-Za-z0-9_]{10,}ztvly-[A-Za-z0-9]{10,}zexa_[A-Za-z0-9]{10,}zgsk_[A-Za-z0-9]{10,}zsyt_[A-Za-z0-9]{10,}zretaindb_[A-Za-z0-9]{10,}zhsk-[A-Za-z0-9]{10,}zmem0_[A-Za-z0-9]{10,}zbrv_[A-Za-z0-9]{10,}zxai-[A-Za-z0-9]{30,}zntn_[A-Za-z0-9]{10,}zfw-[A-Za-z0-9]{30,}zfw_[A-Za-z0-9]{30,}zfpk_[A-Za-z0-9]{30,}zglpat-[A-Za-z0-9_\-]{10,}zgloas-[A-Za-z0-9_\-]{10,}zgldt-[A-Za-z0-9_\-]{10,}zglrt-[A-Za-z0-9_.\-]{10,}zglrtr-[A-Za-z0-9_.\-]{10,}zglcbt-[A-Za-z0-9_\-]{10,}zglptt-[A-Za-z0-9_\-]{10,}zglft-[A-Za-z0-9_\-]{10,}zglimt-[A-Za-z0-9_\-]{10,}zglagent-[A-Za-z0-9_\-]{10,}zglsoat-[A-Za-z0-9_\-]{10,}zglffct-[A-Za-z0-9_\-]{10,}zglwt-[A-Za-z0-9_\-]{10,}zGR1348941[A-Za-z0-9_\-]{10,}zpk-lf-[A-Za-z0-9\-]{8,}zE(?:API_?KEY|KEY|TOKEN|SECRET|PASSWORD|PASSWD|PASS|PW|CREDENTIAL|AUTH)z([A-Z0-9_]{0,50}z&[A-Z0-9_]{0,50})\s*=\s*(['\"]?)(\S+)\2zu([a-z0-9_]+(?:_|^)(?:key|pass|pw|token|secret|password|passwd|credential|auth)(?=[^a-z0-9_]|$))\s*=\s*(['\"]?)(\S+)\2z?(?:api[ _.\-]?key|token|secret|passwd|password|credential|auth)z(['\"]?)([^\s&]+?)\2(?=[\s&]|$)z0^(?:os\.(?:getenv|environ)|process\.env|\$ENV\{)z#([A-Za-z0-9_\-]++\.[A-Za-z0-9_.\-]*z"[A-Za-z0-9_.\-]*+|[A-Za-z0-9_.\-]*z%[A-Za-z0-9_.\-]*\.[A-Za-z0-9_.\-]++)=z((^[ \t]*(?:export[ \t]+)?[A-Za-z0-9_\-]*z[A-Za-z0-9_\-]*)=z:(?:api[ _.\-]?key|token|secret|passwd|password|credential)z(^[ \t]*+[A-Za-z0-9_.\-]*z/[A-Za-z0-9_.\-]*+)(:[ \t]*+)(?!['\"])([^\s&]++)zy(?:api|auth|access|refresh|session|secret)[ _.\\-]?(?:key|token)|token|secret|passwd|password|pass|pw|credential|auth|keysireturncv|dkrdS||dz ||}}|sdS|r|rdS|rI|r5|dzt|kr||dzrdSdS)z=True if position ``i`` in ``s`` begins a word (not mid-word).rTF)isalphaisupperislowerlen)rrprevcurs 0/home/agent/.hermes/hermes-agent/agent/redact.py_is_word_startr(sAvvt!a%!A$#D <<>>t {{}}t {{}}AECFFNNqQx?O?O?Q?QNt 5T allow_pluraljr+c|t|krdS||}|sdS|r||dz rdS|r|dvrt ||dzdSdS)zz+_key_has_secret_keyword...s%---Q-q---r)c3>K|]}|VdSN)r"r3s r' z*_key_has_secret_keyword../s*44qqyy{{444444r)TF)all_KEY_KEYWORD_REfinditerr(startr/end)rlettersms r'_key_has_secret_keywordrA%s.-#---G 344G44444  !))#..  Ac17799-- ,sAEEGG2L2L ttu  % %c * * #qwwyy ) ) l3.H.H 44 5r)z(?:api_?[Kk]ey|token|secret|password|access_token|refresh_token|auth_token|bearer|secret_value|raw_secret|secret_input|key_material)z("z")\s*:\s*"([^"]+)"z?((?:Proxy-)?Authorization:\s*)([A-Za-z][\w.+-]*\s+)?([^\s\"']+)zS(?:x-api-key|x-goog-api-key|api-key|apikey|x-api-token|x-auth-token|x-access-token)(z \s*:\s*)(\S+)z#(bot)?(\d{8,}):([-A-Za-z0-9_]{30,})zH-----BEGIN[A-Z ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z ]*PRIVATE KEY-----zO((?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp)://[^:\s]+:)([^@\s]+)(@)zA((?:https?|wss?|git|ssh|ftp|ftps|sftp)://)([^\s:@/]{8,})(@[^\s]+)z2eyJ[A-Za-z0-9_-]{10,}(?:\.[A-Za-z0-9_=-]{4,}){0,2}z (\+[1-9]\d{6,14})(?![A-Za-z0-9])z;(https?|wss?|ftp)://([^\s/?#]+)([^\s?#]*)\?([^\s#]+)(#\S*)?z+(https?|wss?|ftp)://([^/\s:@]+):([^/\s@]+)@z.([?#&;])([A-Za-z0-9_.~+%\-]+)=([^#&;\s\"'<>]*)z(//)([^/\s?#@]+)@z`\b((?:GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS|TRACE|CONNECT)\s+[^ \t\r\n\"']*?)\?([^ \t\r\n\"']+)zH^[A-Za-z_][A-Za-z0-9_.-]*=[^&\s]*(?:&[A-Za-z_][A-Za-z0-9_.-]*=[^&\s]*)+$z5[\x00-\x1f\x7f\u200b-\u200f\u2028-\u202f\u2060\ufeff]zAABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-.(?.s0PPPda5F5L5LQ5O5OPPPPr)r   c3\K|]'}|tvpt|V(dSr8)_TOKEN_BODY_CHARSrJrKr3s r'r9z-_mask_control_split_tokens..sP&&D*;*A*A!*D*Dr)=)rJsub enumeratelist _PREFIX_REr<groupr=r>searchr:r$appendreversedjoin) rFmask_fnstrippedorig_idxoutmatchesr@body start_origend_origspan replacements r'_mask_control_split_tokensrds!$$R..H4 PPiooPPPH t**CG   * *BBwwqzzaggajj) AEE!HHqL)A-Jx'( DLLDDLLj.?.?.E.EL     BT**d8n.C.C NNJ''$--@ A A A-5g->->55) Hk#' #4#4Jx   773<<r)z?[\x00-\x1f\x7f\x80-\x9f\u200b-\u200f\u202a-\u202e\u2060-\u2064] ***rH)headtailfloor placeholderemptyvaluerhrirjrkrlc|s|Std|}|s|St||kr|S|d|d|| dS)uMask a secret for display, preserving ``head`` and ``tail`` characters. Canonical helper for display-time redaction across Hermes — used by ``hermes config``, ``hermes status``, ``hermes dump``, and anywhere a secret needs to be shown truncated for debuggability while still keeping the bulk hidden. Args: value: The secret to mask. ``None``/empty returns ``empty``. head: Leading characters to preserve. Default 4. tail: Trailing characters to preserve. Default 4. floor: Values shorter than ``head + tail + floor_margin`` are fully masked (returns ``placeholder``). Default 12 — matches the existing config/status/dump convention. placeholder: Value returned for too-short inputs. Default ``"***"``. empty: Value returned when ``value`` is falsy (None, ""). The caller can override this to e.g. ``color("(not set)", Colors.DIM)`` for user-facing display. Examples: >>> mask_secret("sk-proj-abcdef1234567890") 'sk-p...7890' >>> mask_secret("short") # fully masked '***' >>> mask_secret("") # empty default '' >>> mask_secret("", empty="(not set)") # empty override '(not set)' >>> mask_secret("long-token", head=6, tail=4, floor=18) '***' rHNz...)_DISPLAY_CONTROL_RErQr$)rmrhrirjrkrls r' mask_secretrp'ssP   # #B . .E   5zzEETEl . .udUVV} . ..r)r c0|sdSt|dddS)uOMask a log token — conservative 18-char floor, preserves 6 prefix / 4 suffix.rgre)rhrirj)rp)r s r' _mask_tokenrt\s( u u11B 7 7 77r)queryc`|s|Sg}|dD]~}d|vr|||d\}}}|tvr||di||d|S)aRedact sensitive parameter values in a URL query string. Handles `k=v&k=v` format. Sensitive keys (case-insensitive) have values replaced with `***`. Non-sensitive keys pass through unchanged. Empty or malformed pairs are preserved as-is. &rP=***)splitrW partitionlower_SENSITIVE_QUERY_PARAMSrY)rupartspairr_rms r'_redact_query_stringrds  E C   d?? LL    s++ Q 99;;1 1 1 LLC & & & & LL     88E??r)cfdtjdtfd}t||S)uScan text for URLs with query strings and redact sensitive params. Catches opaque tokens that don't match vendor prefix regexes, e.g. `https://example.com/cb?code=ABC123&state=xyz` → `...?code=***&state=xyz`. r@rc|d}|d}|d}t|d}|dpd}|d||d||S) Nr rerH://?rUr)r@scheme authoritypathrufragments r'_subz&_redact_url_query_params.._subsGGAJJ wwqzz$QWWQZZ00771::#@@Y@@@u@h@@@r))reMatchstr_URL_WITH_QUERY_RErQrFrs r'_redact_url_query_paramsrzsD AASAAAA  ! !$ - --r)c:td|S)zStrip `user:password@` from HTTP/WS/FTP URLs. DB protocols (postgres, mysql, mongodb, redis, amqp) are handled separately by `_DB_CONNSTR_RE`. c^|dd|ddS)Nr rr:***@rUr@s r'z&_redact_url_userinfo..s+QWWQZZ55AGGAJJ555r))_URL_USERINFO_RErQrFs r'_redact_url_userinfors%   55   r)namec|}tdD]}t|}||krn|}|ddS)zCDecode a URL parameter name for bounded, case-insensitive matching.r-r)rangercasefoldreplace)rdecodedr next_values r'_canonical_url_param_namersbG 1XX!'**  E      % %c3 / //r)cdtjdtfd}dtjdtfd}t||}t ||S)aKRedact credentials from absolute, relative, and network URL references. This is intentionally stricter than display/log redaction and is used only at explicit secret-egress boundaries. It preserves original keys, separators, public parameters, hosts, and paths while masking sensitive values and URL userinfo. rKrct|dtvr|dS|d|ddS)Nrrr rx)rrUr|)rKs r' _redact_paramz5_redact_strict_url_credentials.._redact_paramsX $U[[^^ 4 4> !++a..6%++a..6666r)c|d}d|vr3|d\}}}|d|dS|ddS)Nr:r rz***@)rUrz)rKuserinfousernamer _passwords r'_redact_userinfoz8_redact_strict_url_credentials.._redact_userinfosk;;q>> (??%-%7%7%<%< "Hakk!nn5h555 5++a..&&&&r))rrr_STRICT_URL_PARAM_RErQ_STRICT_URL_USERINFO_RE)rFrrs r'_redact_strict_url_credentialsrsx7RX7#7777 ''S'''' # #M4 8 8D " & &'7 > >>r)ct|dnt|}|s|St|}t|}|S)aMask secrets in a CDP/browser endpoint URL before it is logged. The global ``redact_sensitive_text`` deliberately passes web-URL query params and ``user:pass@`` userinfo through unmasked (OAuth callbacks, magic-link / pre-signed URLs the agent is meant to follow -- see the web-URL note above). CDP discovery endpoints are NOT such a workflow: their query-string tokens and userinfo passwords are pure credentials that must never reach the logs. So for CDP URLs we opt INTO the two URL redactors that the global pass leaves off. This is the single source of truth for redacting a CDP URL that is passed *directly* to a log or error message. Callers that instead need to redact an exception whose text embeds the URL (e.g. a ``websockets`` connect error) should route that through their own error-text helper, which delegates here -- see ``tools.browser_supervisor._redact_cdp_error_text``. NrH)redact_sensitive_textrrr)rmrFs r'redact_cdp_urlrsK" !u}#e** E ED  #D ) )D  % %D Kr)cfdtjdtfd}t||S)zARedact sensitive query params in HTTP access-log request targets.r@rc~|d}t|d}|d|S)Nr rrr)r@prefixrus r'rz6_redact_http_request_target_query_params.._subs<$QWWQZZ00""5"""r))rrr_HTTP_REQUEST_TARGET_QUERY_RErQrs r'(_redact_http_request_target_query_paramsrs>##S#### ) , ,T4 8 88r)c|rd|vsd|vr|St|s|St|S)uNRedact sensitive values in a form-urlencoded body. Only applies when the entire input looks like a pure form body (k=v&k=v with no newlines, no other text). Single-line non-form text passes through unchanged. This is a conservative pass — the `_redact_url_query_params` function handles embedded query strings. rLrw) _FORM_BODY_RErKstriprrs r'_redact_form_bodyrsZ 44<<3d??   tzz|| , ,  - --r)ch|sdSd}tD]}||r|}n|rd|dndS)uRedact a prefix-matched credential to a NON-REUSABLE sentinel. Unlike :func:`_mask_token` (which keeps head/tail chars — fine for logs that are never fed back into a config), this emits a marker that: * cannot be mistaken for a usable-but-truncated key, so an agent that reads it from a config file and writes it back does NOT corrupt the stored credential into a dead 13-char string (issue #35519); and * still does not leak the secret material (no head/tail chars). The vendor prefix label is preserved for debuggability so the agent can still tell *which* credential is present (e.g. a GitHub PAT vs an OpenAI key) without seeing any of its bytes. u«redacted-secret»rHu «redacted:u…»)_PREFIX_SUBSTRINGS startswith)r labelrQs r'_mask_token_nonreusablersl %$$ E!   C  E E */ I % % % % %4IIr)F)force code_file file_readredact_url_credentialsrrrrc~ |dSt|tst|}|s|S|s ts|S|rd}t|r>|rtnt t | }t fd|}|sd|vrd}t||}d|vrt||}d|vrPt |r6t||}t||}d|vr"d|vrd }t||}d|vr"d|vrd }t ||}d |vsd |vrt"d |}d|vrt$d|}d|vrd}t&||}d|vrd|vrt(d|}d|vrY|rd} t*| |}nt*d|}t,d|}d|vrt.d|}|rt1|}d|vrd|vrt3|}d|vrd} t4| |}|S)uApply all redaction patterns to a block of text. Safe to call on any string -- non-matching text passes through unchanged. Enabled by default. Disable via security.redact_secrets: false in config.yaml. Set force=True for safety boundaries that must never return raw secrets regardless of the user's global logging redaction preference. Set redact_url_credentials=True at non-navigation egress boundaries to additionally redact credential-named query parameters and ``user:pass@`` URL userinfo. The default remains False because actionable OAuth callback, magic-link, and pre-signed URLs must survive ordinary tool flows unchanged. Set code_file=True to skip the ENV-assignment and JSON-field regex patterns when the text is known to be source code (e.g. MAX_TOKENS=*** constants, "apiKey": "test" fixtures). Prefix patterns, auth headers, private keys, DB connstrings, JWTs, and URL secrets are still redacted. Set file_read=True for file *content* returned to the agent (read_file / search_files / cat). Secrets are STILL redacted — they are never exposed — but prefix-matched credentials are replaced with a non-reusable sentinel (``«redacted:ghp_…»``) instead of a head/tail-preserving mask (``ghp_S1...Pn2T``). The old mask looked like a real-but-truncated key, so an agent reading it from config.yaml and writing it back silently corrupted the stored credential into a dead 13-char value → 401 (issue #35519). The sentinel is syntactically invalid as a token, so it can't be mistaken for a usable key or written back as one. Implies code_file=True (config/data files shouldn't trigger the source-code ENV/JSON false-positive paths). Performance: each regex pattern is gated behind a cheap substring pre-check (e.g. ``"=" in text`` for ENV assignments, ``"://" in text`` for URLs, ``"eyJ" in text`` for JWTs). On a typical hermes log line (no secrets) this drops the 13-pattern scan from ~5.6us to ~1.8us per record (-68%). The pre-checks are conservative — false positives still run the full regex, which then doesn't match. False negatives are impossible because every regex requires the gated substring to match. NTc@|dS)Nr r)r@ _prefix_subs r'rz'redact_sensitive_text..Ks AGGAJJ(?(?r)rPcV|d|d|d}}}t|r|dSt|s|dS|d|t ||S)Nr rrrrPrU_ENV_LOOKUP_VALUE_RErKrArt)r@rquoterms r' _redact_envz*redact_sensitive_text.._redact_envPs%&WWQZZQWWQZZUe(--e44&771::% /t44&771::%CCC E(:(:CECCCr)rr"c|d|d}}t|r|dS|dt|dS)Nr rrz: "r)rUrrKrt)r@rrms r' _redact_jsonz+redact_sensitive_text.._redact_jsonzsfWWQZZU(--e44&771::%77+e"4"47777r)cP|d|d|d}}}t|r|dSt|s|dS||t |S)Nr rrrr)r@rseprms r' _redact_yamlz+redact_sensitive_text.._redact_yamls"#''!**aggajj!''!**%S(--e44&771::%/s33&771::%8s8K$6$6888r) uthorization UTHORIZATIONc|d|dpdzt|dzS)Nr rrHrrUrtrs r'rz'redact_sensitive_text..s;aggajjAGGAJJ$4"5 AGGAJJ8O8OOr)cr|dt|dzS)Nr rrrs r'rz'redact_sensitive_text..s'aggajj;qwwqzz#:#::r)ch|dpd}|d}||dS)Nr rHrz:***r)r@rdigitss r'_redact_telegramz/redact_sensitive_text.._redact_telegrams9WWQZZ%2FWWQZZF*f*** *r)BEGINz-----z[REDACTED PRIVATE KEY]c|d}|dr*|dr|dS|dd|dS)Nr{}rr rgr)rUrendswith)r@pws r' _redact_dbz)redact_sensitive_text.._redact_dbspWWQZZ==%%&"++c*:*:&771::%''!**55555r)c\|dd|dS)Nr rgrrrs r'rz'redact_sensitive_text..s(1771::0N0N!''!**0N0Nr)c|dt|d|dS)Nr rrrrs r'rz'redact_sensitive_text..s<J[%<%<JaggajjJJr)eyJcFt|dS)Nr)rtrUrs r'rz'redact_sensitive_text..s[%<%<r)rw+c|d}t|dkr|dddz|ddzS|dddz|ddzS)Nr rz****re)rUr$)r@phones r' _redact_phonez,redact_sensitive_text.._redact_phones`GGAJJE5zzQRaRy6)E"##J66!9v%bcc 2 2r)) isinstancer_REDACT_ENABLED_has_known_prefix_substringrrtrdrTrQ_ENV_ASSIGN_RE_ENV_ASSIGN_LOWER_RE_CFG_SECRET_WORD_RErV_CFG_DOTTED_RE_CFG_ANCHORED_RE_JSON_FIELD_RE_YAML_ASSIGN_RE_AUTH_HEADER_RE_SECRET_HEADER_RE _TELEGRAM_RE_PRIVATE_KEY_RE_DB_CONNSTR_RE_URL_BARE_TOKEN_RE_JWT_RErr_SIGNAL_PHONE_RE) rFrrrrrrrrrrrs @r'rrsZ |t dC 4yy  _  #4(( G1:K-- *$ <<~~????FF G; $;; D D D"%%k488DD  +// TBBD  %8%?%?%E%E %))+t<<'++K>> $;;3$;; 8 8 8"%%lD99D $;;5,, 9 9 9#&&|T::D 4!7!7"" O O    d{{ $$ : :     d{{ + + + 0$77$7d??""#;TBB }}  V 6 6 6 "%%j$77DD!%%&N&NPTUUD"%% J J     }}{{<envsetexportdeclareprintenv> nlbatcattacrhlessmoreritypeviewzcatbatcatcommandc|sdStjd|}|D]}|}|s|}|r|dtvr?|ddD]}|dr|d}|ddd d dd }|tvrd SdS) udReturn True if ``command`` reads a ``.env`` file to stdout. Detects file-read commands (``cat``, ``head``, ``tail``, etc.) where any argument's basename is a ``.env``-style file. Template files (``.env.example``, ``.env.sample``, ...) are not in the basename list and therefore never match. Handles pipelines and command sequences. Conservative defense-in-depth, not a boundary — indirect reads (``sudo cat .env``, ``/bin/cat .env``, ``$(cat .env)``, redirection, ``sed``/``awk``/``xxd`` readers) are not detected, matching the precedent of ``is_env_dump_command`` below. F[|;&]+rr Nrz"'/\T)rryr_FILE_READ_COMMANDSrrsplitr{_ENV_FILE_BASENAMES)rsegmentssegtokensargbasenames r'_command_reads_env_filer s ux 7++Hiikk    *=== !"":  C~~c"" ))E""Czz#q))"-44T1==bAH~~#666ttt7  5r)c6|rt|tsdStjd|}|D]g}|}|s t j|}n$#t $r|}YnwxYw|r|dtvrdShdS)aReturn True if ``command`` dumps environment variables to stdout. Detects ``env`` / ``printenv`` / ``set`` / ``export`` / ``declare`` as the first token of any segment in a pipeline or sequence (``;`` / ``&&`` / ``||`` / ``|``). Conservative: a parse failure or anything unrecognized returns False (callers then fall back to the safer code_file=True path, which still masks prefix-shaped keys). FrrT)rrrryrshlex ValueError_ENV_DUMP_COMMANDS)rrrrs r'is_env_dump_commandr#5s *Wc22ux 7++H  iikk   ![%%FF ! ! !YY[[FFF !  fQi#55544 5s A  BB)routputct|s|S|pd}t|pt| }t|||S)u^Redact secrets from terminal/process stdout. Single redaction policy for ALL terminal-output surfaces — foreground ``terminal`` results AND background ``process(action=poll/log/wait)`` output — so they can't diverge. Picks ``code_file`` based on whether ``command`` is an environment dump or reads a ``.env`` file: - env-dump command (``env``/``printenv``/``set``/``export``/``declare``) → ``code_file=False`` so the ENV-assignment pass masks opaque tokens. - file-read command targeting a ``.env`` file (``cat .env``, ``head .env.local``, etc.) → ``code_file=False`` for the same reason. Per AGENTS.md, ``.env`` files contain only secrets, so the generic ENV pass is the right one (keys whose names carry no secret keyword can still slip through it — same limit as the env-dump path). - anything else (or unknown command) → ``code_file=True`` to avoid false positives on source/config dumps. ``force=True`` bypasses the global ``security.redact_secrets`` preference for safety boundaries that must never emit raw credentials. rH)rr)r#rr)r$rrcmdrs r'redact_terminal_outputr'OsM.  -RC(--M1H1M1MNI u J J JJr)patterncTd}t|D]\}}||vr |d|cS|S)aGReturn the leading literal characters of a regex pattern. Stops at the first regex metacharacter (``[``, ``(``, ``\``, ``.``, ``?``, ``*``, ``+``, ``|``, ``{``, ``^``, ``$``). Returns the literal that any match of the pattern MUST contain as a substring, so the pre-screen never produces false negatives. z [(\.?*+|{^$N)rR)r(metarchs r'_extract_literal_prefixr,xsK D7##2 ::2A2;     Nr)cd}d}|t|kr||}|dkr|dz }'|dkr~|dz }|t|kr||dkr|dz }|t|krA||dkr5||dkr|dz }|dz }|t|kr ||dk5n4|dkr|dz }n(|dkrtd|dz }n|d kr|dkrd S|dz }|t|kd S) aTrue if ``pattern`` contains a ``|`` outside any group or class. A top-level alternation defeats the literal-prefix guarantee: ``_extract_literal_prefix`` stops at ``|``, so for ``ab|.*`` it returns ``ab`` even though the ``.*`` branch is not bound by that prefix and matches anything. Grouped alternation after the prefix (``ab(?:x|y)``) keeps the guarantee and stays allowed. rrr[r ]rB)rDTF)r$max)r(depthrr+s r'_has_top_level_alternationr3sF E A c'll   QZ :: FA  99 FA3w<<GAJ#$5$5Qc'll""wqzS'8'81:%%FAQc'll""wqzS'8'83YY QJEE 3YY519%%EE 3YY5A::4 Q' c'll  ( 5r)cdtdtffd }dg}d}|tkrH|}|dkr|dz }(|dkr~|d z }|tkr|d kr|d z }|tkrA|d kr5|dkr|d z }|d z }|tkr |d k5n|d kr|dn{|d krIt|d kr|nd}|r||d zrd S|dp||d<n,||r!d |d<|dkrd|}|d z }|tkHdS)u'True if an unbounded quantifier applies to a group containing one. ``(a+)+``, ``(?:x*)*``, ``(a{2,})+`` — the canonical catastrophic- backtracking (ReDoS) shape. Registered patterns run against every log line, tool output, and transcript chunk, so a pathological pattern from a buggy plugin would stall the host process, not just the plugin. Detects structural nesting only; ambiguity between overlapping alternation branches (``(a|aa)+``) is not statically detected and remains the plugin author's responsibility. r,rc|tkrdS|dvrdS|dkr\d|}|dkr |dz|nd}|ddo|d SdS) NFz*+Trrrr rH,)r$findisdigitr)r,kr_r(s r'_unbounded_quantifier_followszC_has_nested_unbounded_repeat.._unbounded_quantifier_followss G  5 1:  4 1:   S!$$A'(Bww71q57##BD9$$&&=4==+=+= =ur)Frrrr.r r/rBr0Trrr)intboolr$rWpopr7)r(r:contains_unboundedrr+inners` r'_has_nested_unbounded_repeatr@s           A c'll   QZ :: FA  99 FA3w<<GAJ#$5$5Qc'll""wqzS'8'81:%%FAQc'll""wqzS'8'83YY  % %e , , , , 3YY034F0G0G!0K0K&**,,,QVE 66q1u== t%7%;%Du r " " * *1 - - )%) r "SyyLLa(( Q1 c'll  2 5r)c#4K|]}t|VdSr8r,r4ps r'r9r9s<#$Ar)cDtfdtDS)zReturn True if ``text`` contains any known credential prefix substring. Used as a cheap pre-check before invoking the expensive ``_PREFIX_RE``. c3 K|]}|vV dSr8r2)r4rDrFs r'r9z._has_known_prefix_substring..s'55QqDy555555r))anyrrs`r'rrs) 5555"4555 5 55r)_PLUGIN_PREFIX_PATTERNScHdtDS)z5All plugin-registered patterns in registration order.cg|] }|D]}| Sr2r2)r4patternsrDs r'r6z$_plugin_patterns..s% Q Q Q( Q Q1A Q Q Q Qr))rHvaluesr2r)r'_plugin_patternsrMs# Q Q5<<>> Q Q QQr)cttz}tjdd|zdzat d|DadS)a Recompile the prefix alternation and pre-screen substrings. ``redact_sensitive_text`` and ``_mask_token_nonreusable`` look these globals up at call time, so swapping the module attributes (atomic under the GIL) propagates immediately to every caller. rCrDrEc34K|]}t|VdSr8rBrCs r'r9z*_rebuild_prefix_matcher..s+LLa6q99LLLLLLr)N)_PREFIX_PATTERNSrMrcompilerYrTtupler)combineds r'_rebuild_prefix_matcherrT se "2"4"44H(!3!336KKJLL8LLLLLr)pluginsourcec`g}|pgD]}t|tr|std|H|} t j|n9#t j$r'}td|||Yd}~d}~wwxYwt|rtd||t|rtd||tt|dkrtd||B|tvs|tvs||vrtd||}|||rt 5t"|g|t)dddn #1swxYwYtd |t|t|S) uAdditively register credential-token regexes with the redaction engine. Each accepted pattern joins the vendor-prefix alternation used by ``redact_sensitive_text`` (same masking, same head/tail rules, same non-reusable sentinel on ``file_read``) — everywhere built-in patterns apply: logs, terminal output, transport errors, transcripts. Per-pattern validation (invalid entries are warned and skipped, never raised — a broken plugin must not break startup): * must be a non-empty string that compiles as a regex; * must not contain a top-level alternation (``ab|.*`` would escape the literal-prefix guarantee below through its unprefixed branch; grouped alternation after the prefix, ``ab(?:x|y)``, is allowed); * must not nest unbounded quantifiers (``(a+)+``-style patterns can backtrack catastrophically, and registered patterns run against every log line and tool output — see ``_has_nested_unbounded_repeat``); * must start with at least 2 literal characters (the pre-screen substring gate in ``_has_known_prefix_substring`` needs a literal anchor; it also structurally rules out redact-everything patterns like ``.*``); * duplicates of built-in or already-registered patterns are skipped. Args: patterns: iterable of regex strings (e.g. ``[r"nvapi-[A-Za-z0-9_-]{20,}"]``). source: attribution label for log lines (e.g. ``"plugin:my-plugin"``). Returns: The number of patterns actually accepted. z/%s: skipping empty/non-string redaction patternz.%s: skipping invalid redaction pattern %r (%s)Nu%s: skipping redaction pattern %r — top-level alternation escapes the literal-prefix guarantee (in 'ab|.*' the prefix binds only the first branch); wrap alternation in a group after the prefix, e.g. 'ab(?:x|y)'u%s: skipping redaction pattern %r — nested unbounded quantifiers (e.g. '(a+)+') can backtrack catastrophically, and registered patterns run on every log line and tool outputru~%s: skipping redaction pattern %r — must start with at least 2 literal characters (needed for the pre-screen substring gate)z+%s: redaction pattern %r already registeredz&%s: registered %d redaction pattern(s))rrrloggerwarningrrQerrorr3r@r$r,rPrMdebugrW_registry_lockrH setdefaultextendrTinfo)rKrVacceptedr(excs r'register_redaction_patternsrbs@H>r*!*!'3'' w}}  NNLf U U U --//  Jw    x    NN@    HHHH   &g . .  NN=      ' 0 0  NN      &w// 0 01 4 4 NN"      & & &'5E5G5G*G*G7V^K^K^ LLFPW X X X       & & # . .vr : : A A( K K K # % % % & & & & & & & & & & & & & & &  4fc(mm    x==s*$A99B/B**B/$=G--G14G1ct5ttddddS#1swxYwYdS)z:Drop all plugin-registered patterns (tests/teardown only).N)r\rHclearrTr2r)r' _reset_plugin_redaction_patternsreqs ""%%'''!!!""""""""""""""""""s(=AA) zGET zPOST zPUT zPATCH zDELETE zHEAD zOPTIONS zTRACE zCONNECT cl|tfdtDS)z?Cheap pre-check before scanning for access-log request targets.c3 K|]}|vV dSr8r2)r4methoduppers r'r9z-_has_http_method_substring..s'EE6vEEEEEEr))rirG_HTTP_METHOD_SUBSTRINGS)rFris @r'_has_http_method_substringrks4 JJLLE EEEE-DEEE E EEr)cBeZdZdZdfd Zdejdeffd ZxZ S) RedactingFormatterz9Log formatter that redacts secrets from all log messages.N%c @tj|||fi|dSr8)super__init__)selffmtdatefmtstylekwargs __class__s r'rqzRedactingFormatter.__init__s,gu7777777r)recordrcdt|}t|Sr8)rpformatr)rrrxoriginalrws r'rzzRedactingFormatter.formats&77>>&))$X...r))NNrn) __name__ __module__ __qualname____doc__rqlogging LogRecordrrz __classcell__)rws@r'rmrmsrCC888888/W./3//////////r)rmr8)rN)rU)grrosrr  threading urllib.parseragent.file_safetyrr getLoggerr|rX frozensetr|_SENSITIVE_BODY_KEYSgetenvr{rrP_SECRET_ENV_NAMESrQr IGNORECASEr_SECRET_CFG_NAMES _CFG_VALUErrr MULTILINEr_YAML_CFG_NAMESrr;rr;r<r(r/rA_JSON_KEY_NAMESrr_SECRET_HEADER_NAMESrrrrrrrrrrrrrrJrOrYrTrdrorprtrrrrrobjectrrrrrr"rrr#r'r,r3r@rRrrrHdict__annotations__Lockr\rSrMrTrbrerjrk Formatterrmr2r)r'rs&  %%%%%%TSSSSS  8 $ $ $)%%%,!y"""4")3V<<BBDDHbb<<<P]U+UUU "rz}M,W / !bj!2BMBB "rz7+<* M 2:`0A``T^``MBL P"*aaaaMBL <"*AM c c d     :>   C C $ $    4Z-/---M""*FM[BJ, ,,,Mrz* "*OVM( RZM  "*%  2:ABB  RZ2:2"rz5 %"*!+ M!! O BJ<IG RZSXX&6777:OO 1S1c1111p!bjF2/2/2/ 2/ 2/  2/  2/  2/ 2/ 2/2/2/2/j8s8s8888, .3 .3 . . . . s s    0C0C0000??????0&S293939999 .C .C . . . . J3J3JJJJ<#( kkk k k k  k ! k kkkkjYNNNOO i!!!&S4Z&D&&&&Rt6(,K>CKKK K*K7;KKKKKR S S    D8#8$8888vU(8 6c6d66662!#"""!!R$RRRR M M M MTT#TSTTTTn"""" FSFTFFFF /////*/////r)